@unleash/proxy - npm Package Compare versions

Comparing version 0.13.0 to 0.13.1

dist/app.js

@@ -16,2 +16,4 @@ "use strict";
     const config = (0, config_1.createProxyConfig)(options);
+    const { logger } = config;
+    logger.debug('Configuration:', config);
     const client = unleashClient || new client_1.default(config);
@@ -28,3 +30,3 @@ const openApiService = new openapi_service_1.OpenApiService(config);
     catch (err) {
-        config.logger.error(`The provided "trustProxy" option was not valid ("${config.trustProxy}")`, err);
+        logger.error(`The provided "trustProxy" option was not valid ("${config.trustProxy}")`, err);
     }
@@ -31,0 +33,0 @@ if (typeof options.preHook === 'function') {

dist/config.js

@@ -131,2 +131,17 @@ "use strict";
 }
+function loadHttpOptions(option) {
+    if (option.httpOptions) {
+        return {
+            httpOptions: option.httpOptions,
+        };
+    }
+    if (process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED) {
+        return {
+            httpOptions: {
+                rejectUnauthorized: safeBoolean(process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED, true),
+            },
+        };
+    }
+    return {};
+}
 function chooseLogger(option) {
@@ -197,3 +212,3 @@ const logLevel = option.logLevel || process.env.LOG_LEVEL;
         cors: loadCorsOptions(option),
-        ...(!!option.httpOptions ? { httpOptions: option.httpOptions } : {}),
+        ...loadHttpOptions(option),
     };
@@ -200,0 +215,0 @@ }

dist/openapi/openapi-helpers.js

@@ -15,3 +15,2 @@ "use strict";
         type: 'object',
-        additionalProperties: { type: 'string' },
     },
@@ -18,0 +17,0 @@ style: 'form',

dist/openapi/spec/lookup-toggles-schema.d.ts

@@ -26,7 +26,3 @@ import { CreateSchemaType } from '../openapi-types';
                     additionalProperties: {
-                        anyOf: [{
-                            type: "string";
-                        }, {
-                            type: "number";
-                        }];
+                        type: "string";
                     };
@@ -74,7 +70,3 @@ example: {
                     additionalProperties: {
-                        anyOf: [{
-                            type: "string";
-                        }, {
-                            type: "number";
-                        }];
+                        type: "string";
                     };
@@ -81,0 +73,0 @@ example: {

dist/openapi/spec/unleash-context-schema.d.ts

@@ -23,7 +23,3 @@ import { CreateSchemaType } from '../openapi-types';
             readonly additionalProperties: {
-                readonly anyOf: readonly [{
-                    readonly type: "string";
-                }, {
-                    readonly type: "number";
-                }];
+                readonly type: "string";
             };
@@ -59,7 +55,3 @@ readonly example: {
             additionalProperties: {
-                anyOf: [{
-                    type: "string";
-                }, {
-                    type: "number";
-                }];
+                type: "string";
             };
@@ -66,0 +58,0 @@ example: {

dist/openapi/spec/unleash-context-schema.js

@@ -16,3 +16,3 @@ "use strict";
             additionalProperties: {
-                anyOf: [{ type: 'string' }, { type: 'number' }],
+                type: 'string',
             },
@@ -19,0 +19,0 @@ example: {

dist/test/config.test.js

@@ -377,2 +377,12 @@ "use strict";
 });
+test('should load config.httpOptions.rejectUnauthorized from env', () => {
+    process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED = 'true';
+    const config = (0, config_1.createProxyConfig)({
+        unleashUrl: 'some',
+        unleashApiToken: 'some',
+        clientKeys: ['s1'],
+    });
+    expect(config.httpOptions?.rejectUnauthorized).toBe(true);
+    delete process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED;
+});
 test.each([
@@ -379,0 +389,0 @@ '/base/path',

dist/test/openapi.test.js

@@ -7,2 +7,3 @@ "use strict";
 const supertest_1 = __importDefault(require("supertest"));
+const swagger_parser_1 = __importDefault(require("@apidevtools/swagger-parser"));
 const app_1 = require("../app");
@@ -17,6 +18,11 @@ const client_mock_1 = __importDefault(require("./client.mock"));
 });
-test.skip('should serve the OpenAPI UI', async () => (0, supertest_1.default)(app)
-    .get('/docs/openapi/')
-    .expect(200)
-    .then((response) => expect(response.text).toMatchSnapshot()));
+test('should serve the OpenAPI UI', async () => {
+    const res = await (0, supertest_1.default)(app).get('/docs/openapi/').expect(200);
+    const body = res.text;
+    expect(body).toMatchSnapshot();
+});
+test('validate open api response', async () => {
+    const res = await (0, supertest_1.default)(app).get('/docs/openapi.json').expect(200);
+    await swagger_parser_1.default.validate(res.body);
+});
 test('should serve the OpenAPI spec', async () => (0, supertest_1.default)(app)
@@ -23,0 +29,0 @@ .get('/docs/openapi.json')

example.js

@@ -23,3 +23,3 @@ const port = process.env.PORT || process.env.PROXY_PORT || 3000;
     // unleashInstanceId: '1337',
-    // logLevel: 'info',
+    logLevel: 'debug',
     // projectName: 'order-team', // optional
@@ -26,0 +26,0 @@ // environment: 'development',

package.json

 {
   "name": "@unleash/proxy",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "The Unleash Proxy (Open-Source)",
@@ -59,2 +59,3 @@ "main": "dist/index.js",
     "@typescript-eslint/parser": "^5.22.0",
+    "@apidevtools/swagger-parser": "10.1.0",
     "babel-jest": "^28.0.3",
@@ -61,0 +62,0 @@ "eslint": "^8.14.0",

README.md

@@ -140,2 +140,3 @@ ![Build & Tests](https://github.com/Unleash/unleash-proxy/workflows/Node.js%20CI/badge.svg?branch=main)
 | cors.preflightContinue    | `CORS_PREFLIGHT_CONTINUE`        | `false`         |    no    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| httpOptions.rejectUnauthorized    | `HTTP_OPTIONS_REJECT_UNAUTHORIZED`        | `true`         |    no    | If true, unleash-proxy will automatically reject connections to unleash server with invalid certificates                                                                                                                                                                                                                                                                                                                                                                                                    |
 
@@ -142,0 +143,0 @@

src/app.ts

@@ -16,2 +16,4 @@ import compression from 'compression';
     const config = createProxyConfig(options);
+    const { logger } = config;
+    logger.debug('Configuration:', config);
     const client = unleashClient || new Client(config);
@@ -31,3 +33,3 @@
     } catch (err) {
-        config.logger.error(
+        logger.error(
             `The provided "trustProxy" option was not valid ("${config.trustProxy}")`,
@@ -34,0 +36,0 @@ err,

src/config.ts

@@ -234,2 +234,23 @@ import { CorsOptions } from 'cors';
 
+function loadHttpOptions(option: IProxyOption): IProxyOption {
+    if (option.httpOptions) {
+        return {
+            httpOptions: option.httpOptions,
+        };
+    }
+
+    if (process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED) {
+        return {
+            httpOptions: {
+                rejectUnauthorized: safeBoolean(
+                    process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED,
+                    true,
+                ),
+            },
+        };
+    }
+
+    return {};
+}
+
 function chooseLogger(option: IProxyOption): Logger {
@@ -331,4 +352,4 @@ const logLevel = option.logLevel || (process.env.LOG_LEVEL as LogLevel);
         cors: loadCorsOptions(option),
-        ...(!!option.httpOptions ? { httpOptions: option.httpOptions } : {}),
+        ...loadHttpOptions(option),
     };
 }

src/openapi/openapi-helpers.ts

@@ -26,3 +26,2 @@ import { OpenAPIV3 } from 'openapi-types';
             type: 'object',
-            additionalProperties: { type: 'string' },
         },
@@ -29,0 +28,0 @@ style: 'form',

src/openapi/spec/unleash-context-schema.ts

@@ -14,3 +14,3 @@ import { createSchemaObject, CreateSchemaType } from '../openapi-types';
             additionalProperties: {
-                anyOf: [{ type: 'string' }, { type: 'number' }],
+                type: 'string',
             },
@@ -17,0 +17,0 @@ example: {

src/test/config.test.ts

@@ -422,2 +422,16 @@ import * as path from 'path';
 
+test('should load config.httpOptions.rejectUnauthorized from env', () => {
+    process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED = 'true';
+
+    const config = createProxyConfig({
+        unleashUrl: 'some',
+        unleashApiToken: 'some',
+        clientKeys: ['s1'],
+    });
+
+    expect(config.httpOptions?.rejectUnauthorized).toBe(true);
+
+    delete process.env.HTTP_OPTIONS_REJECT_UNAUTHORIZED;
+});
+
 test.each([
@@ -424,0 +438,0 @@ '/base/path',

src/test/openapi.test.ts

 import request from 'supertest';
 import { Application } from 'express';
+import SwaggerParser from '@apidevtools/swagger-parser';
 import { createApp } from '../app';
@@ -18,8 +19,13 @@ import MockClient from './client.mock';
 
-test.skip('should serve the OpenAPI UI', async () =>
-    request(app)
-        .get('/docs/openapi/')
-        .expect(200)
-        .then((response) => expect(response.text).toMatchSnapshot()));
+test('should serve the OpenAPI UI', async () => {
+    const res = await request(app).get('/docs/openapi/').expect(200);
+    const body = res.text;
+    expect(body).toMatchSnapshot();
+});
 
+test('validate open api response', async () => {
+    const res = await request(app).get('/docs/openapi.json').expect(200);
+    await SwaggerParser.validate(res.body);
+});
+
 test('should serve the OpenAPI spec', async () =>
@@ -26,0 +32,0 @@ request(app)

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

455586

increased by0.51%

Lines of code

7280

increased by0.69%

Number of lines in readme file

345

increased by0.29%

Worsened metrics

Dev dependency count

24

increased by4.35%

Number of low supply chain risk alerts

93

increased by4.49%

No dependency changes